Is it possible to create an alert when someone logs into a Windows Virtual Machine and send it to an e-mail address?

Question

We have a few Windows 2019 VMs (no ADDS so standalone) but like to have a signal/alert when somebody tries to login locally the Windows server VM.

KR

Answer 1

Yes, it is possible to create an alert and send to the desired email/sms etc. when a user logins the azure virtual machine.
Here is how I am setting it up to get an email alert.
VM Blade >Monitoring> Diagnostic settings>Enable Guest Level Monitoring Make sure that you have a storage account at the same region

'Enable' Insights under Monitoring>Insights

Monitoring>Alerts->Create New Alert Rule

Select a Custom query as follows

VMConnection | where Direction == "inbound" | where Protocol == "tcp" | where DestinationPort == 3389  

Create an Action Group to send alerts

Select the preferred way of getting alerts

Select the preferred Alert Logic

Set Alert details as per the preference

Now you are ready to save the alert rules. It may take couple of minutes to start getting the alerts. Then you will start receiving the alerts something like follows when there is an RDP connection detected like following message in your inbox

----------

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

@Manu Philip ,
Thank you. I will try it out and let you know :).

Answer 3

I set this up, but get nothing in the query results. I am using SSH and adjusted. I simply query the entire log and nothing there. Do you have to adjust logging level or anything?

Answer 4

It worked for me in one GO on a Windows VM. Thank you.
Is it also possible to see who has logged in?

Answer 5

yeah there is an appearent issue with the linux agent. microsoft likes to half-bake things